G Data
Monthly
Local privilege escalation in G DATA Total Security lets a low-privileged user abuse the Backup Service to delete an arbitrary file via a symbolic link (CWE-59 link following), which can be leveraged to run arbitrary code as NT AUTHORITY\SYSTEM. Discovered and reported through the Zero Day Initiative (ZDI-26-432, ZDI-CAN-28665); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor-assigned CVSS 3.0 base score is 7.8 (High), reflecting full SYSTEM-level compromise achievable by any authenticated local user.
An issue was discovered in G-Data before 25.5.9.25 using Symbolic links, it is possible to abuse the infected-file restore mechanism to achieve arbitrary write that leads to elevation of privileges. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local privilege escalation in G DATA Total Security lets a low-privileged user abuse the Backup Service to delete an arbitrary file via a symbolic link (CWE-59 link following), which can be leveraged to run arbitrary code as NT AUTHORITY\SYSTEM. Discovered and reported through the Zero Day Initiative (ZDI-26-432, ZDI-CAN-28665); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor-assigned CVSS 3.0 base score is 7.8 (High), reflecting full SYSTEM-level compromise achievable by any authenticated local user.
An issue was discovered in G-Data before 25.5.9.25 using Symbolic links, it is possible to abuse the infected-file restore mechanism to achieve arbitrary write that leads to elevation of privileges. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.